Executive Summary

This vulnerability exists in the MySQL NDB Cluster product of Oracle MySQL, specifically in the Cluster: NDB Operator component. It affects supported versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0. The vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by the MySQL NDB Cluster. The vulnerability has a high severity with a CVSS 3.1 base score of 9.6, indicating significant confidentiality and integrity impacts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with low privileges and network access to compromise the MySQL NDB Cluster, resulting in unauthorized creation, deletion, or modification of critical data.

This means that sensitive or important data could be altered or deleted without authorization, potentially disrupting business operations or causing data loss.

Additionally, the attacker could gain unauthorized access to all data accessible by the MySQL NDB Cluster, leading to potential data breaches and exposure of confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all MySQL NDB Cluster accessible data. Such unauthorized access and data manipulation can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

Because the vulnerability impacts confidentiality and integrity of data with a high CVSS score (9.6), organizations using affected versions of MySQL NDB Cluster may face compliance risks if this vulnerability is exploited, potentially resulting in breaches of regulatory requirements for protecting sensitive personal or health information.

Useful 0 Not Useful 0